Debian Bug report logs - #925134
grub-efi-amd64-signed: doesn't mount cryptodisk

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Paolo Miotto <paolo.miotto@uniud.it>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: grub-efi-amd64-signed: doesn't mount cryptodisk

Date: Wed, 20 Mar 2019 08:33:05 +0000

[Message part 1 (text/plain, inline)]

Package: grub-efi-amd64
Version: 2.02+dfsg1-13
Severity: critical

Dear Maintainer,

this is a continuation of BUG #917117, that is archived.

In that bug every GRUB2 update removes cryptomount call from /boot/efi/EFI/debian/grub.cfg, and thus breaks the boot.

Now if I call update-grub, all is fine, but every package update (this happens for 2.02+dfsg1-12 and 2.02+dfsg1-13)
removes cryptomount call from /boot/efi/EFI/debian/grub.cfg again, and breaks the boot.

I have

  GRUB_ENABLE_CRYPTODISK=y

in /etc/default/grub

and /boot/efi/EFI/debian/grub.cfg was:

  insmod luks
  insmod lvm
  cryptomount (hd0,gpt2)
  search.fs_uuid 0c4e1d15-07b4-4757-9fd4-02a8e0c42e1b root lvmid/iRGCxh-2PcK-EDWe-zWim-n3Qu-F0KP-HMOfJi/bzEuy6-onGG-oFyt-fAIn-q69G-c9RE-t0iHce
  set prefix=($root)'/boot/grub'
  configfile $prefix/grub.cfg

and becomes

  search.fs_uuid 0c4e1d15-07b4-4757-9fd4-02a8e0c42e1b root lvmid/iRGCxh-2PcK-EDWe-zWim-n3Qu-F0KP-HMOfJi/bzEuy6-onGG-oFyt-fAIn-q69G-c9RE-t0iHce
  set prefix=($root)'/boot/grub'
  configfile $prefix/grub.cfg

I've tried

  apt install --reinstall grub-efi-amd64

and the /boot/efi/EFI/debian/grub.cfg was changed again.



--

Mandi.

Paolo

[Message part 2 (text/html, inline)]

Message #10 received at 925134@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: Paolo Miotto <paolo.miotto@uniud.it>, 925134@bugs.debian.org

Subject: Re: Bug#925134: grub-efi-amd64-signed: doesn't mount cryptodisk

Date: Sat, 23 Mar 2019 14:01:00 +0000

On Wed, Mar 20, 2019 at 08:33:05AM +0000, Paolo Miotto wrote:
> this is a continuation of BUG #917117, that is archived.
> 
> In that bug every GRUB2 update removes cryptomount call from /boot/efi/EFI/debian/grub.cfg, and thus breaks the boot.
> 
> Now if I call update-grub, all is fine, but every package update (this happens for 2.02+dfsg1-12 and 2.02+dfsg1-13)
> removes cryptomount call from /boot/efi/EFI/debian/grub.cfg again, and breaks the boot.

Could you please describe, in as much detail as possible, how to set up
an environment that replicates this bug?  The setup described in
https://bugs.debian.org/cgi-bin/bugreport.cgi?archive=no&bug=924151#20
doesn't reproduce this problem, and I need something along those lines
that does reproduce this in order to fix it.

Thanks,

-- 
Colin Watson                                       [cjwatson@debian.org]

Message #15 received at 925134@bugs.debian.org (full text, mbox, reply):

From: Paolo Miotto <paolo.miotto@uniud.it>

To: Colin Watson <cjwatson@debian.org>, "925134@bugs.debian.org" <925134@bugs.debian.org>

Subject: Re: Bug#925134: grub-efi-amd64-signed: doesn't mount cryptodisk

Date: Mon, 25 Mar 2019 10:36:19 +0000

Il 23/03/19 15:01, Colin Watson ha scritto:
> Could you please describe, in as much detail as possible, how to set up
> an environment that replicates this bug?


Hello Colin, thanks for your reply.


Installing the package grub-efi-amd64 with this command line:

   apt install --reinstall grub-efi-amd64

still removes from /boot/efi/EFI/debian/grub.cfg any line like this:

   insmod luks


But now both the vms that I've installed to replicate the bug and my 
laptop are booting correctly without that line.

I don't know why immediately after the package upgrade it didn't works 
and now it works, but I'm not able to replicate it to help who have a 
similar upgrade path.


I have a detailed description of the steps to replicate the line 
removal, but, as this is no more a issue, I don't know if you want to 
investigate further. If so, feel free to ask.


Bye.


-- 

Paolo

Message #20 received at 925134@bugs.debian.org (full text, mbox, reply):

From: Paolo Miotto <paolo.miotto@uniud.it>

To: Colin Watson <cjwatson@debian.org>, "925134@bugs.debian.org" <925134@bugs.debian.org>

Subject: Re: Bug#925134: grub-efi-amd64-signed: doesn't mount cryptodisk

Date: Wed, 3 Apr 2019 14:14:42 +0000

[Message part 1 (text/plain, inline)]

I noticed that I haven't told that I'm on buster (I took it for granted based on the package version).


On 2019-03-30 I upgraded my system and I suffer again of this bug: without explicit "insmod luks" in /boot/efi/EFI/debian/grub.cfg the boot stops in a grub shell.


This packages where upgraded by the update (from /var/log/apt/history.log, purged from apps upgrades):

Start-Date: 2019-03-30  20:55:36
Commandline: apt full-upgrade
Requested-By:
Upgrade: grub-efi:amd64 (2.02+dfsg1-13, 2.02+dfsg1-16), grub-common:amd64 (2.02+dfsg1-13, 2.02+dfsg1-16), grub2-common:amd64 (2.02+dfsg1-13, 2.02+dfsg1-16), grub-efi-amd64-bin:amd64 (2.02+dfsg1-13, 2.02+dfsg1-16),  grub-efi-amd64:amd64 (2.02+dfsg1-13, 2.02+dfsg1-16), grub-efi-amd64-signed:amd64 (1+2.02+dfsg1+13, 1+2.02+dfsg1+16)
End-Date: 2019-03-30  20:55:52

Start-Date: 2019-03-30  20:56:05
Commandline: apt autoremove --purge
Requested-By:
Purge: efibootmgr:amd64 (15-1)
End-Date: 2019-03-30  20:56:05


I've tried to reinstall efibootmgr but nothing changes.


I can do some tests, but I need directions.


--

Mandi.

Paolo

[Message part 2 (text/html, inline)]

Message #25 received at 925134@bugs.debian.org (full text, mbox, reply):

From: Chris Hofstaedtler <zeha@debian.org>

To: Colin Watson <cjwatson@debian.org>, 924151@bugs.debian.org, 925134@bugs.debian.org

Cc: Joerg Jaspert <joerg@ganneff.de>

Subject: Re: Bug#924151: grub2-common: wrong grub.cfg for efi boot and fully encrypted disk

Date: Sat, 6 Apr 2019 21:52:24 +0200

* Colin Watson <cjwatson@debian.org> [190406 19:50]:
> Hmm.  I tried doing that in a virt-manager VM as follows:
> 
>  * started with a buster alpha-5 netinst ISO rather than the full DVD
>    image, since my bandwidth is very limited
>  * configured VM to use UEFI
>  * guided partitioning; selected full-disk encryption; deleted /boot
>    partition; accepted all other defaults
>  * waited for grub-installer to fail, then appended
>    GRUB_ENABLE_CRYPTODISK=y to /target/etc/default/grub and tried again
>  * ran into #918590 and mounted /target/run to work around it

FTR, I've tried this as well, and found it to work.
Now both bug reports hint at upgrading packages, but my reproduction
try did not need any upgrades as it was a fresh install. So maybe
the key lies there...

Cheers,
Chris

Message #30 received at 925134@bugs.debian.org (full text, mbox, reply):

From: Mark Caglienzi <mark.caglienzi@gmail.com>

To: 925134@bugs.debian.org

Subject: Re: grub-efi-amd64-signed: doesn't mount cryptodisk

Date: Thu, 4 Jul 2019 18:34:01 +0200

[Message part 1 (text/plain, inline)]

Hi all,
is this bug relevant yet?

I have a buster laptop (so no VM, but real hardware, and no fresh
install) with encrypted disk, and I blocked the upgrade of grub since
March because of the fear to not be able to boot it after the upgrade of
grub.

I am still with 2.02+dfsg1-12 because of this.

The severity is critical (and if the bug is confirmed, I understand
that's *critical*), but I don't understand if I can upgrade or not.

I don't see "movement" in the thread since some months, and the bug just
"lies here".

Thanks in advance,
Mark

[signature.asc (application/pgp-signature, attachment)]

Message #35 received at 925134@bugs.debian.org (full text, mbox, reply):

From: Felix Defrance <felix@d2france.fr>

To: 925134@bugs.debian.org

Subject: Re: grub-efi-amd64-signed: doesn't mount cryptodisk

Date: Sun, 7 Jul 2019 01:00:04 +0200

[Message part 1 (text/plain, inline)]

Hi Mark and all,

I'm in the same situation. So what do we do ?

Thx

On Thu, 4 Jul 2019 18:34:01 +0200 Mark Caglienzi
<mark.caglienzi@gmail.com> wrote:

> Hi all,
> is this bug relevant yet?
>
> I have a buster laptop (so no VM, but real hardware, and no fresh
> install) with encrypted disk, and I blocked the upgrade of grub since
> March because of the fear to not be able to boot it after the upgrade of
> grub.
>
> I am still with 2.02+dfsg1-12 because of this.
>
> The severity is critical (and if the bug is confirmed, I understand
> that's *critical*), but I don't understand if I can upgrade or not.
>
> I don't see "movement" in the thread since some months, and the bug just
> "lies here".
>
> Thanks in advance,
> Mark
>

-- 
Félix Defrance
PGP: 0x46A603D10F04DC57

[signature.asc (application/pgp-signature, attachment)]

Message #40 received at 925134@bugs.debian.org (full text, mbox, reply):

From: "Anon Nymous" <j8f49iokmjsdg@gmx.de>

To: 925134@bugs.debian.org

Subject: Query

Date: Wed, 10 Jul 2019 16:33:50 +0200

[Message part 1 (text/html, inline)]

Message #45 received at 925134@bugs.debian.org (full text, mbox, reply):

From: "Anon Nymous" <j8f49iokmjsdg@gmx.de>

To: 925134@bugs.debian.org

Subject: Query

Date: Wed, 10 Jul 2019 16:36:26 +0200

I want to avoid spamming this, but please someone make clarity.


Debian Buster got released now, here is a critical bug in a very common software, and apparently nobody cared about closing/postponing for several months.
While I understand that many a volunteers and so on, for a Debian "stable" this is a bit disappointing, even more so if we're stuck with the still existing problem in stable.

Message #50 received at 925134@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: Anon Nymous <j8f49iokmjsdg@gmx.de>, 925134@bugs.debian.org

Subject: Re: Bug#925134: Query

Date: Wed, 10 Jul 2019 17:02:12 +0100

On Wed, Jul 10, 2019 at 04:36:26PM +0200, Anon Nymous wrote:
> I want to avoid spamming this, but please someone make clarity.
> 
> 
> Debian Buster got released now, here is a critical bug in a very common software, and apparently nobody cared about closing/postponing for several months.
> While I understand that many a volunteers and so on, for a Debian "stable" this is a bit disappointing, even more so if we're stuck with the still existing problem in stable.

Well, as far as I can tell, nobody ever gave me a full and useful answer
to my question in
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=925134#10, and so I
don't have a way to reproduce this bug.  Until somebody answers that
question in enough detail that I can set up a corresponding test VM,
this bug is very likely to remain stalled, no matter how much people
explain how very disappointing that is.

That said, I see that nobody has yet linked to
https://cryptsetup-team.pages.debian.net/cryptsetup/encrypted-boot.html
in this bug, which discusses some issues with LUKS header format
versions.  It's not clear whether that's the problem that everyone in
this bug has, but perhaps it will help some.

-- 
Colin Watson                                       [cjwatson@debian.org]

Message #55 received at 925134@bugs.debian.org (full text, mbox, reply):

From: "Anon Nymous" <j8f49iokmjsdg@gmx.de>

To: 925134@bugs.debian.org

Subject: Re

Date: Wed, 10 Jul 2019 20:46:18 +0200

Thank you very much for your answer.
 
It helps to understand the current situation.
(There was no way to tell if discussions happened somewhere else than here, and/or if there were more details to how and when people are affected, how frequent, etc. And some maintainers are quite lazy with closing fixed bugs wven if they are completely fixed)
 
At least for me, this answer is all I asked for, and more.
And I'll try to run some tests in the direction you mentioned.

Message #62 received at 925134@bugs.debian.org (full text, mbox, reply):

From: Andrew Savchenko <andrew@lists.savchenko.net>

To: 925134@bugs.debian.org

Subject: Re: grub-efi-amd64-signed: doesn't mount cryptodisk

Date: Thu, 8 Apr 2021 21:38:34 +0930

For what it's worth, I am unable to reproduce it on the latest weekly build of 
Bullseye. Paolo, are you OK for this bug to be closed?


-- 
Regards,
A

Message #71 received at 925134@bugs.debian.org (full text, mbox, reply):

From: Ben Hutchings <ben@decadent.org.uk>

To: 925134@bugs.debian.org

Subject: Re: grub-efi-amd64-signed: doesn't mount cryptodisk

Date: Sat, 04 Mar 2023 17:40:36 +0100

[Message part 1 (text/plain, inline)]

It seems like this bug is related to GRUB lacking LUKS2 support.  Back
in buster, GRUB only supported LUKS1, so this bug could only be worked-
around by using LUKS1 for /boot.

Now GRUB has some support for LUKS2 at boot time, but grub-probe
doesn't recognise LUKS2 devices properly so the necessary modules don't
get loaded automatically.

There is a separate bug report #1028301 explicitly relating to grub-
probe.  I found the upstream commits that seem to fix it and added them
to that bug report.  Perhaps they would also fix this?

Ben.

-- 
Ben Hutchings
The two most common things in the universe are hydrogen and stupidity.

[signature.asc (application/pgp-signature, inline)]

Message #76 received at 925134-done@bugs.debian.org (full text, mbox, reply):

From: Paul Gevers <elbrus@debian.org>

To: 925134-done@bugs.debian.org, 924151-done@bugs.debian.org, 945001-done@bugs.debian.org, 558422-done@bugs.debian.org

Subject: Closing old src:grub2 RC bugs where progress isn't likely

Date: Wed, 9 Jul 2025 18:31:47 +0200

[Message part 1 (text/plain, inline)]

Hi,

After alignment with Steve, I'm closing these old bugs in src:grub2 as 
they seem to lack the required information to make them actionable.

If new information surfaces to reproduce the bug or maybe even a fix, 
the bug can be unarchived and reopened.

Paul
(Release Team member hat on)

[OpenPGP_signature.asc (application/pgp-signature, attachment)]

Send a report that this bug log contains spam.